« Volver al listado

CVE-2026-46625

Estado: ModificadaAlta (7.5)—

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}).

Leer descripción completaMostrar menos

The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningRestrict Web-Based ContentPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network Traffic

Tecnologías afectadas (6)

Js-cookie — Javascript CookieRedhat — 3scale API ManagementRedhat — Ansible Automation PlatformRedhat — Enterprise LinuxRedhat — Openshift AIRedhat — Openshift Lightspeed

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-46625",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-46625",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-11T14:46:15.083511Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "js-cookie",
          "product": "js-cookie",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.0.7"
            }
          ]
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:cryostat:4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Cryostat 4 on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "4.2.0-13",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "cryostat/cryostat-grafana-dashboard-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.10::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
          "versions": [
            {
              "status": "unaffected",
              "version": "1783357140",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "advanced-cluster-security/rhacs-main-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_portal:2.1"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2.1",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787047114",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "ansible-automation-platform/automation-portal",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_portal:2.2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2.2",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787047188",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "ansible-automation-platform/automation-portal",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.7::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2.7",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787218409",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "ansible-automation-platform-27/gateway-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhdh:1.10::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Developer Hub 1.10",
          "versions": [
            {
              "status": "unaffected",
              "version": "1785333413",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhdh/red-hat-developer-hub-backstage-plugin-lightspeed",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhdh:1.10::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Developer Hub 1.10",
          "versions": [
            {
              "status": "unaffected",
              "version": "1785340831",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhdh:1.10::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Developer Hub 1.10",
          "versions": [
            {
              "status": "unaffected",
              "version": "1785332928",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhdh:1.10::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Developer Hub 1.10",
          "versions": [
            {
              "status": "unaffected",
              "version": "1785411652",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhdh/rhdh-hub-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhdh:1.9::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Developer Hub 1.9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1785972843",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhdh/rhdh-hub-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_ai:3.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift AI 3.4",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787347991",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhoai/odh-dashboard-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_ai:3.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift AI 3.4",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787250508",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhoai/odh-mod-arch-automl-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_ai:3.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift AI 3.4",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787251550",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhoai/odh-mod-arch-autorag-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_ai:3.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift AI 3.4",
          "versions": [
            {
              "status": "unaffected",
              "version": "1786611759",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_ai:3.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift AI 3.4",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787251250",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhoai/odh-mod-arch-maas-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_ai:3.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift AI 3.4",
          "versions": [
            {
              "status": "unaffected",
              "version": "1786612219",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhoai/odh-mod-arch-mlflow-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_ai:3.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift AI 3.4",
          "versions": [
            {
              "status": "unaffected",
              "version": "1787250617",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhoai/odh-mod-arch-model-registry-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_mesh:3.3::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Service Mesh 3.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "1782231869",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_mesh:3.3::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Service Mesh 3.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "1782201466",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-service-mesh/kiali-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_lightspeed"
          ],
          "vendor": "Red Hat",
          "product": "OpenShift Lightspeed",
          "packageName": "openshift-lightspeed/lightspeed-console-plugin-419-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_lightspeed"
          ],
          "vendor": "Red Hat",
          "product": "OpenShift Lightspeed",
          "packageName": "openshift-lightspeed/lightspeed-console-plugin-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp21/system",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp22/system",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp2/system-rhel7",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp2/system-rhel8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp2/system-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2",
          "packageName": "automation-gateway",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2",
          "packageName": "automation-hub",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2",
          "packageName": "automation-platform-ui",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2",
          "packageName": "python3.11-galaxy-ng",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2",
          "packageName": "python3.12-galaxy-ng",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2",
          "packageName": "python3x-galaxy-ng",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2",
          "packageName": "python-galaxy-ng",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Discovery 2",
          "packageName": "discovery/discovery-ui-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "packageName": "grafana-pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "packageName": "grafana",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "packageName": "grafana-pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "packageName": "grafana-pcp",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7",
          "packageName": "js-cookie",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "packageName": "js-cookie",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "packageName": "js-cookie",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "packageName": "rhoai/odh-mod-arch-eval-hub-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "packageName": "openshift4/ose-agent-installer-ui-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-10T22:16:59.613",
  "references": [
    {
      "url": "https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:33183",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:36625",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:48126",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:48151",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:49642",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:52768",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:56338",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:56357",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:59153",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:60520",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-46625",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487740",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46625.json",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "description": [
        {
          "lang": "en",
          "value": "CWE-915"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's \"__proto__\" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7."
    },
    {
      "lang": "es",
      "value": "JavaScript Cookie es una API de JavaScript para manejar cookies, del lado del cliente. Antes de la versión 3.0.7, la función auxiliar interna assign() de js-cookie copia propiedades con for...in + asignación simple. Cuando el objeto fuente es producido por JSON.parse, el miembro __proto__ del objeto JSON es una propiedad enumerable propia, por lo que el for...in lo enumera y la escritura target[key] = source[key] activa el setter Object.prototype.__proto__ en el nuevo objetivo ({}). El resultado es un secuestro de prototipo por instancia: Object.prototype en sí no se modifica, pero el objeto de atributos fusionados ahora hereda claves controladas por el atacante. Debido a que la función set() consumidora luego enumera el objeto fusionado con otro for...in, cada clave que el atacante colocó en el prototipo contaminado termina en la cadena Set-Cookie resultante como un par de atributos. El atacante puede establecer domain=, secure=, samesite=, expires=, y path= en cookies cuyos atributos el desarrollador pensó que estaban bloqueados. Este problema ha sido parcheado en la versión 3.0.7."
    }
  ],
  "lastModified": "2026-09-09T13:20:18.357",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:js-cookie:javascript_cookie:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49EF678B-9E16-4A9D-9612-8E142C330086",
              "versionEndExcluding": "3.0.7"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:3scale_api_management:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5434CC8-66E0-4378-AAB3-B2FECDDE61BB"
            },
            {
              "criteria": "cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B4BE2D6-43C3-4065-A213-5DB1325DC78F"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openshift_ai:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EBF0A70A-E606-48C8-82C2-4D8760146265"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openshift_lightspeed:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C34B05C8-C19C-497F-8E1D-8F6039CDB185"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}